Im trying to "grasp" how a user should authenticate to our API. Our API is setup to use OpenID Connect thats issued by an ADFS-server. However.. as a "consumer" of our application, whould one expect there to be an endpoint for requesting an access-token? Or should we simply not provide an endpoint for that, and "expect" (with some instructions to our users) that the user requests an access token directly from the ADFS-server?.. whats the common pattern/flow? Since both our API and the ADFS-server is connected to the same domain, we are currently using Single sign on (not sure if that matters, but just providing that information in case it would).